CN110121196B

CN110121196B - Security identifier management method and device

Info

Publication number: CN110121196B
Application number: CN201810114251.0A
Authority: CN
Inventors: 毕晓宇; 侯云静
Original assignee: Datang Mobile Communications Equipment Co Ltd
Current assignee: Datang Mobile Communications Equipment Co Ltd
Priority date: 2018-02-05
Filing date: 2018-02-05
Publication date: 2021-11-02
Anticipated expiration: 2038-02-05
Also published as: CN110121196A

Abstract

The application discloses a security identifier management method and device. A network function entity allocates a non-access stratum (NAS) security identifier for a terminal, wherein the NAS security identifier is used for identifying an NAS security context, and the NAS security context is used for protecting the security of the established NAS connection; and the network function entity sends the NAS security identification to the terminal. Wherein the NAS security identity comprises: the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; and a non-3GPP NAS security identifier, which is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access.

Description

Security identifier management method and device

Technical Field

The present invention relates to the field of communications technologies, and in particular, to a method and an apparatus for managing a security identifier.

Background

The 5G system is a service-oriented convergence system, and has a wider application scenario than a Long Term Evolution (LTE) system. For example, 5G systems support ultra-reliable, low-latency communications for applications including industrial automation (remote) control systems, and may also support a large number of efficient, high-cost, high-density internet of things devices. The 5G system includes a 5G Access Network (5G Access Network, 5G-AN) and a 5G Core Network (5G Core Network, 5 GC).

In order to implement the security policy of the 5G system, security identifier management needs to be performed in the 5G system.

At present, no security identifier management scheme exists for the 5G system.

Disclosure of Invention

The embodiment of the application provides a security identifier management method and device.

In a first aspect, a security identifier management method is provided, including:

a network function entity allocates a non-access stratum (NAS) security identifier for a terminal, wherein the NAS security identifier is used for identifying an NAS security context, and the NAS security context is used for protecting the security of the established NAS connection;

and the network function entity sends the NAS security identification to the terminal.

Optionally, the NAS security context identified by the 3GPP NAS security identifier includes an NAS key derived based on shared key derivation, an NAS counter value, and an NAS connection identifier;

the NAS security context identified by the non-3GPP NAS security identity comprises an NAS key obtained based on shared key deduction, an NAS counter value and an NAS connection identity.

Optionally, the NAS security identity includes:

the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; and a non-3GPP NAS security identifier, which is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access.

Optionally, the NAS key included in the NAS security context identified by the 3GPP NAS security identity is derived based on a first shared key, the NAS key included in the NAS security context identified by the non-3GPP NAS security identity is derived based on a second shared key, and the second shared key is derived based on the first shared key;

the 3GPP NAS security identification and the non-3GPP NAS security identification have different values.

Optionally, the NAS key included in the NAS security context identified by the 3GPP NAS security identifier is derived based on a first shared key, and the NAS key included in the NAS security context identified by the non-3GPP NAS security identifier is derived based on the first shared key.

The 3GPP NAS security identification and the non-3GPP NAS security identification have the same value.

Optionally, the sending, by the network function entity, the NAS security identifier to the terminal includes:

and the network function entity sends NAS information to a terminal, wherein the NAS information carries the NAS safety identification.

Optionally, the NAS security identity includes: the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; the non-3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access;

the network function entity sends an NAS message to a terminal, wherein the NAS message carries the NAS security identifier, and the NAS message comprises:

after the network functional entity performs identity authentication on the 3GPP access initiated by the terminal, a first NAS security mode command is sent to the terminal, and the first NAS security mode command carries the 3GPP NAS security identification;

and the network function entity sends a second NAS security mode command to the terminal after the terminal initiates the non-3GPP access, wherein the second NAS security mode command carries the non-3GPP NAS security identification.

after the network functional entity performs identity authentication on the non-3GPP access initiated by the terminal, a first NAS security mode command is sent to the terminal, and the first NAS security mode command carries the non-3GPP NAS security identification;

and the network function entity sends a second NAS security mode command to the terminal after the terminal initiates the 3GPP access, wherein the second NAS security mode command carries the 3GPP NAS security identification.

Optionally, the sending the NAS security identifier to the terminal includes:

and the network functional entity sends an authentication request message to the terminal, wherein the authentication request message carries the NAS security identification.

Optionally, the NAS security identity includes:

an identification value information field for bearing the value of the NAS security identification;

and the security context type information field is used for bearing the indication information of the security context type.

Optionally, the network function entity is an AMF.

In a second aspect, a network function entity is provided, including:

the terminal comprises an allocation module, a non-access stratum (NAS) security identifier, a Network Access Stratum (NAS) security context and a Network Access Server (NAS) security context, wherein the allocation module is used for allocating the NAS security identifier for the terminal, the NAS security identifier is used for identifying the NAS security context, and the NAS security context is used for protecting the security of the established NAS connection;

and the sending module is used for sending the NAS security identification to the terminal.

In a third aspect, a network function entity is provided, including: the system comprises a processor, a memory and a transceiver, wherein the processor, the memory and the transceiver are connected through a bus; the processor is used for reading the program in the memory and executing:

allocating a non-access stratum (NAS) security identifier for a terminal, wherein the NAS security identifier is used for identifying an NAS security context, and the NAS security context is used for protecting the security of the established NAS connection;

and sending the NAS security identification to the terminal through the transceiver.

Optionally, the NAS security identity includes:

Optionally, the processor is specifically configured to:

and sending an NAS message to a terminal through the transceiver, wherein the NAS message carries the NAS security identification.

the processor is specifically configured to:

after the identity authentication is carried out on the 3GPP access initiated by the terminal, a first NAS security mode command is sent to the terminal through the transceiver, and the first NAS security mode command carries the 3GPP NAS security identification;

and after the terminal initiates non-3GPP access, sending a second NAS security mode command to the terminal through the transceiver, wherein the second NAS security mode command carries the non-3GPP NAS security identification.

the processor is specifically configured to:

after identity authentication is carried out on non-3GPP access initiated by the terminal, a first NAS security mode command is sent to the terminal through the transceiver, and the non-3GPP NAS security identification is carried by the first NAS security mode command;

and after the terminal initiates the 3GPP access, sending a second NAS security mode command to the terminal through the transceiver, wherein the second NAS security mode command carries the 3GPP NAS security identification.

Optionally, the processor is specifically configured to:

and sending an authentication request message to the terminal through the transceiver, wherein the authentication request message carries the NAS security identifier.

Optionally, the NAS security identity includes:

Optionally, the network function entity is an AMF.

In a fourth aspect, there is provided a computer-readable storage medium having stored thereon computer-executable instructions for causing the computer to perform the method of any of the first aspects above.

In a fifth aspect, there is provided a computer product for causing a computer to perform the functions performed by an authentication server in any one of the possible designs of the method according to any one of the first aspect described above, when the computer product is run by the computer.

In a sixth aspect, a security identifier management method is further provided, including:

a network function entity distributes a security identifier for a terminal, wherein the security identifier is used for identifying a key shared between the terminal and a network side and a non-access stratum (NAS) security context obtained based on key deduction;

and the network function entity sends the security identification to the terminal.

The network side entity may be an entity belonging to different PLMNs, and the terminal stores the first security identifier and the second security identifier at the same time. The first security identification is used for identifying a key shared by 3GPP access and a non-access stratum (NAS) security context obtained based on key deduction; the second security identifier is used for identifying a key shared by non-3GPP access and a non-access stratum NAS security context obtained based on the key deduction.

Optionally, the network function entity is an AUSF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a 3GPP access;

the network function entity distributes a security identifier for the terminal, and the method comprises the following steps:

the AUSF acquires an authentication vector of a terminal and generates the safety identification for the terminal;

the network function entity sends the security identifier to the terminal, including:

and the AUSF sends an identity authentication start response message to the SEAF, the identity authentication start response message carries the safety identification, the identity authentication start response message is used for triggering the SEAF to send an authentication request message to the terminal, and the authentication request message carries the safety identification.

Optionally, the network functional entity is an AMF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a 3GPP access;

the AMF receives a shared secret key sent by the SEAF and generates a security identifier for the shared secret key, wherein the shared secret key is a shared secret key between the terminal and the AMF;

the AMF sends a security identification to the UE through a non-access stratum message, wherein the type of the non-access stratum message is an attachment request response or a registration response, or a periodic update message response, or a NAS security mode command message.

Optionally, the network functional entity is an AUSF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a non-3GPP access;

and the AUSF sends an AAA message to the SEAF, the AAA message carries the security identifier, the AAA message is used for triggering the SEAF to send an authentication request message to the terminal through the N3IWF, and the authentication request message carries the security identifier.

Optionally, the network functional entity is an AMF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a non-3GPP access;

the AMF receives a shared secret key sent by the SEAF, generates a security identifier for the terminal, and sends the security identifier to the N3IWF to trigger the N3IWF to send an authentication success message to the terminal, wherein the authentication request message carries the security identifier.

Optionally, the network functional entity is an N3IWF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a non-3GPP access;

and the N3IWF receives the shared key sent by the AUSF, generates a security identifier for the terminal, and sends a message that the security identifier passes the authentication success to the UE.

Optionally, the security identity is carried in a newly defined information element following the EAP-AKA' protocol.

Optionally, the method further comprises:

and the target AMF switched by the terminal distributes a safety identification for the terminal and sends a switching request message to a target base station of the terminal, wherein the switching request message carries the currently distributed safety identification.

Optionally, the security identifier includes:

an identification value information field for bearing the value of the safety identification;

In a seventh aspect, there is further provided a network function entity, including:

the terminal comprises an allocation module, a network side and a non-access stratum (NAS) security context, wherein the allocation module is used for allocating a security identifier for the terminal, and the security identifier is used for identifying the NAS security identifier shared between the terminal and the network side and the non-access stratum (NAS) security context deduced based on the NAS security identifier;

and the sending module is used for sending the safety identification to the terminal.

In an eighth aspect, there is also provided a network function entity, including: the system comprises a processor, a memory and a transceiver, wherein the processor, the memory and the transceiver are connected through a bus; the processor is used for reading the program in the memory and executing:

allocating a security identifier for a terminal, wherein the security identifier is used for identifying a NAS security identifier shared between the terminal and a network side and a non-access stratum (NAS) security context derived based on the NAS security identifier;

and sending the security identification to the terminal through the transceiver.

The security identification is a key identification used in a 5G system.

the processor is specifically configured to:

and the AUSF sends an identity authentication start response message to the SEAF through the transceiver, wherein the identity authentication start response message carries the safety identification, and the identity authentication start response message is used for triggering the SEAF to send an authentication request message to the terminal, and the authentication request message carries the safety identification.

the processor is specifically configured to: the AMF receives a shared secret key sent by the SEAF and generates a security identifier for the shared secret key, wherein the shared secret key is a shared secret key between the terminal and the AMF;

the transceiver sends a security identifier to the UE through a non-access stratum message through the AMF, wherein the type of the non-access stratum message is an attach request response or a registration response, or a periodic update message response, or a NAS security mode command message.

and the AUSF sends an AAA message to the SEAF through the transceiver, the AAA message carries the security identifier, the AAA message is used for triggering the SEAF to send an authentication request message to the terminal through the N3IWF, and the authentication request message carries the security identifier.

the processor is specifically configured to: transmitting, by the transceiver, the security identifier to the terminal, including:

and the N3IWF receives the shared key sent by the AUSF through the transceiver, generates a security identifier for the terminal, and sends the authentication success message of the security identifier to the UE.

Optionally, the processor is further configured to:

Optionally, the security identifier includes:

In a ninth aspect, there is provided a computer-readable storage medium having stored thereon computer-executable instructions for causing the computer to perform the method of any of the sixth aspects above.

A tenth aspect is a computer product operable, when run by a computer, to cause the computer to perform the functions performed by an authentication server in any one of the possible designs of the method according to any one of the preceding sixth aspects.

In the above embodiment of the present application, a network function entity allocates an NAS security identifier to a terminal, and the network function entity sends the NAS security identifier to the terminal. Wherein the NAS security identity is used for identifying NAS security context, and the NAS security context is used for protecting the security of the established NAS connection; the NAS security identity comprises: the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; and a non-3GPP NAS security identifier, which is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access. Therefore, the network functional entity can allocate the NAS security identifier for the terminal, thereby realizing the management of the security identifier.

Drawings

Fig. 1 is a schematic diagram of a 5G system architecture applicable to the embodiment of the present application;

fig. 2 is a schematic diagram illustrating that a UE accesses to a 5G core network based on a 3GPP access network and a non-3GPP access network according to an embodiment of the present application;

fig. 3 is a schematic key hierarchy diagram in a 5G system according to an embodiment of the present disclosure;

fig. 4 is a schematic view of a security identifier management process provided in an embodiment of the present application;

fig. 5 is a schematic view of a security identifier management process according to an embodiment of the present application;

fig. 6 is a schematic view of a security identifier management process according to an embodiment of the present application;

fig. 7 is a schematic view of a security identifier management process according to an embodiment of the present application;

fig. 8 is a schematic format diagram of an NAS security identifier according to an embodiment of the present application;

fig. 9 is a schematic format diagram of another NAS security identifier provided in the embodiment of the present application;

fig. 10 is a schematic view of a security identifier management process according to an embodiment of the present application;

fig. 11 is a schematic view of a security identifier management process according to an embodiment of the present application;

fig. 12 is a schematic view of a security identifier management process according to an embodiment of the present application;

FIG. 13 is a schematic illustration provided by an embodiment of the present application;

fig. 14 is a schematic view of a security identifier management process according to an embodiment of the present application;

fig. 15 is a schematic view of a security identifier management process according to an embodiment of the present application;

FIG. 16 is a schematic view of an apparatus provided by an embodiment of the present application;

FIG. 17 is a schematic view of an apparatus provided by an embodiment of the present application;

fig. 18 is a schematic structural diagram of a network function entity according to an embodiment of the present application;

fig. 19 is a schematic structural diagram of a network function entity according to an embodiment of the present application.

Detailed Description

Hereinafter, some terms in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

(1) In the embodiments of the present application, the terms "network" and "system" are often used interchangeably, but those skilled in the art can understand the meaning.

(2) In the embodiment of the present application, the terms "network device" and "network element" and "network functional entity" may be used interchangeably. For example, an access and mobility management function (AMF) may be referred to as an AMF entity or an AMF network element, or simply referred to as an AMF; for another example, the authentication service function (AUSF) may be referred to as an AUSF entity or an AUSF network element, or simply referred to as an AUSF. Both AMF and AUSF may be collectively referred to as network devices.

(3) In the embodiments of the present application, the term "plurality" means two or more, and other terms are similar thereto.

(4) "and/or" describes the association relationship of the associated objects, meaning that there may be three relationships, e.g., a and/or B, which may mean: a exists alone, A and B exist simultaneously, and B exists alone. The character "/" generally indicates that the former and latter associated objects are in an "or" relationship.

The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

The embodiment of the application provides a method and a device for managing a security identifier, which are applicable to a 5G system or an evolution system thereof, and also applicable to other communication systems.

Referring to fig. 1, a schematic diagram of a 5G system architecture provided in the embodiment of the present application is shown. The system architecture may include the following network elements:

-an authentication service function (AUSF);

-access and mobility management function (AMF);

-a Data Network (DN), such as an operator service, internet access or third party service, etc.;

-a Network Slice Selection Function (NSSF);

-Policy Control Function (PCF);

-Session Management Function (SMF);

-unified data management function (UDM);

-unified data repository function (UDR);

-User Plane Function (UPF);

-Application Function (AF);

-AN access network (R) AN node;

security authentication anchor function (SEAF).

Each network element is an independent logical function entity, and some network elements may also be combined, for example, the SEAF and the AMF may be combined.

The system architecture further comprises a terminal. Among them, a terminal is also called User Equipment (UE), a Mobile Station (MS), a Mobile Terminal (MT), etc., and is a device providing voice and/or data connectivity to a user, for example, a handheld device with a wireless connection function, a vehicle-mounted device, etc. Currently, some examples of terminals are: a mobile phone (mobile phone), a tablet computer, a notebook computer, a palm top computer, a Mobile Internet Device (MID), a wearable device, a Virtual Reality (VR) device, an Augmented Reality (AR) device, a wireless terminal in industrial control (industrial control), a wireless terminal in self driving (self driving), a wireless terminal in remote surgery (remote medical supply), a wireless terminal in smart grid (smart grid), a wireless terminal in transportation safety (smart security), a wireless terminal in city (smart city), a wireless terminal in home (smart home), and the like.

As shown in fig. 1, N1 denotes a reference point between a UE and AN AMF, N2 denotes a reference point between a (R) AN node and AN AMF, N3 denotes a reference point between a (R) AN node and AN UPF, N4 denotes a reference point between AN UPF and AN SMF, N5 denotes a reference point between a PCF and AN AF, N6 denotes a reference point between AN UPF and a DN, N7 denotes a reference point between AN SMF and a PC, N8 denotes a reference point between AN AMF and a UDM, N9 denotes a reference point between two core UPFs, N10 denotes a reference point between a UDM and AN SMF, N11 denotes a reference point between AN AMF and AN SMF, N12 denotes a reference point between AN AUSF and AN AMF, N13 denotes a reference point between AN AUSF and AN UDM, N14 denotes a reference point between two AMFs, N15 denotes a reference point between AN AMF and a PCF, and N22 denotes a reference point between AN NSSF and AN AMF.

The network architecture described in the embodiment of the present application is for more clearly illustrating the technical solution of the embodiment of the present application, and does not constitute a limitation to the technical solution provided in the embodiment of the present application, and it is known by a person skilled in the art that as the network architecture evolves, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.

In a 5G system, a UE may access a 5G core network through a 3GPP access network and/or a non-3GPP access network.

Fig. 2 shows a schematic diagram of a UE accessing a 5G core network based on a 3GPP access network and a non-3GPP access network. A secure tunnel is established between the UE and a Non-3GPP interworking function (N3 IWF), and the secure tunnels are used for the secure transmission of control plane and user plane information exchange between the UE accessed by the Non-3GPP and the 5G core network.

When the UE accesses the 5G core network through the 3GPP access network and the independent non-3GPP access network, there are multiple NAS connections between the UE and the AMF. Further, in case that the UE accesses to a 5G core network of the same Public Land Mobile Network (PLMN) through the 3GPP access network and the non-3GPP access network at the same time, if the selected N3IWF and the AMF are in the same PLMN, the same AMF provides a service. It can be understood that there are two separate NAS connections for the UE when accessing through non-3GPP and 3 GPP.

In the 5G system, in order to ensure the security of the transmission, a corresponding NAS security context may be allocated to the NAS connection for the secure transmission based on the NAS connection. Different NAS connections may use different NAS security contexts. The NAS security context may include a shared secret key generated by authentication, a NAS ciphering algorithm and an integrity algorithm, an uplink and downlink NAS counter value (NAS COUNT) and other parameters that may identify the NAS connection, and may further include a NAS secret key derived based on the shared secret key derivation. NAS keys can be derived from other key deductions. Fig. 3 shows a key hierarchy of a 5G system.

Referring to fig. 3, a schematic diagram of a key hierarchy in a 5G system provided in an embodiment of the present application is shown.

The key hierarchy includes the following keys:

(1) key shared between a UE and an Authentication trusted replication and Processing Function (ARPF)

K: a permanent key stored in a Universal Subscriber Identity Module (USIM) and an ARPF;

CK/IK: the ARPF and USIM generate a key pair in the authentication process.

(2) Key shared by Mobile Equipment (ME) and AUSF

K_AUSF: the UE and the AUSF derive the obtained key according to the CK/IK;

(3) ME and SEAF shared secret key

K_SEAF: UE and SEAF according to K_AUSFDeducing the obtained key;

(4) ME and AMF shared secret key

K_AMF: UE and AMF rootAccording to K_SEAFDeducing the obtained key;

(5) NAS key

K_NASint: NAS secret key for integrity protection, UE and network element of core network according to K_AMFDeducing the obtained key;

K_NASenc: NAS secret key for encryption algorithm, UE and network element of core network according to K_AMFThe resulting key is deduced.

When a UE accesses through both a 3GPP access network and a separate non-3GPP access network, there are multiple NAS connections for the UE, such as one NAS connection through the 5G-RAN and one NAS connection through the non-3GPP access network. Generally, for the purpose of security isolation, two different sets of NAS security context (which may include NAS keys) are established to protect the different NAS connections respectively. In addition, in a scenario of inter-system interaction in a 5G system, there may be a handover between the 5G system and the 4G system, a handover between an Evolved Packet System (EPS) of the 4G system and an N3IWF in a core network of the 5G system, and a handover between an evolved packet data gateway (ePDG) of the 4G system and the 5G system, and thus, there may exist various security contexts.

In the embodiment of the application, the security context can be uniquely identified through the security identifier. By using the security identifier, the UE and the network element of the core network can identify the corresponding security context, and the corresponding security context can be reused without starting the authentication procedure in the subsequent connection.

The key management method of the LTE system cannot be used in the 5G system for the following reasons: as previously described, when a UE has multiple NAS connections with a network, different NAS connections need to be protected using different security contexts. For example, a NAS key for a NAS connection established when the UE accesses the 3GPP access network needs to be allocated, and another NAS key needs to be allocated for a NAS connection established when the UE accesses the non-3GPP access network. In the key management method of the LTE system, there is no scenario of multiple NAS connections, and there cannot be corresponding security identifiers for security contexts of different NAS connections, so that the key management method cannot be used in a 5G system.

In the embodiment of the application, the NAS security identifier is introduced, and for convenience of description, the NAS security identifier is represented as ngKSI_NAS。ngKSI_NASFor identifying a NAS security context, the NAS security context may contain a NAS key (K)_NASintAnd/or K_NASenc). When there are multiple NAS connections between the UE and the network side (e.g., AMF), different NAS connections use different NAS security contexts, which are assigned with different ngKSIs_NAS。

In the embodiment of the present application, another security context identifier is optionally introduced, and for convenience of description, it is referred to as ngKSI. The security context identified by ngKSI may contain a shared secret key K_AMF(by K)_AMFNAS key can be derived) the security identity can be associated with K_AMFStored together and sent to the UE by the network side in the authentication process or handover process.

The following describes a security identifier management flow diagram provided in the embodiment of the present application with reference to fig. 4 to fig. 7.

Referring to fig. 4, a schematic view of a security identifier management process provided in the embodiment of the present application is shown, where the process may include:

s401: network function entity distributes NAS security identification ngKSI for terminal_NAS。

Wherein, ngKSI_NASFor identifying a NAS security context. The NAS security context is used to secure the established NAS connection.

The NAS security context may contain the NAS Key, ngKSI_NASAssociated with the NAS key. Optionally, the NAS key is based on a key K shared between the terminal and the AMF_AMFAnd deducing to obtain.

Wherein, ngKSI_NASA 3GPP NAS security identity and a non-3GPP NAS security identity may be included. The 3GPP NAS security identifier is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access (the NAS security context can contain NAS secret key K for integrity protection)_NASintAnd/or NAS key K for encryption algorithms_NASencAnd algorithms for NAS integrity and ciphering and NAS COUNT and the likeParameters); the non-3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access (the NAS security context can contain NAS secret key K 'for integrity protection'_NASintAnd/or NAS key K 'for encryption algorithm'_NASencAnd algorithms for NAS integrity and ciphering and parameters such as NAS COUNT).

Optionally, a NAS key (such as K) contained in a NAS security context identified by the 3GPP NAS security identity_NASintAnd/or K_NASenc) And a NAS key (such as K ') contained in a NAS security context identified by the non-3GPP NAS security identity'_NASintAnd/or K'_NASenc) May be based on the same shared secret key K_AMFAnd the 3GPP NAS security identification and the non-3GPP NAS security identification have different values obtained by deduction.

Optionally, a NAS key (such as K) contained in a NAS context identified by the 3GPP NAS security identity_NASintAnd/or K_NASenc) Based on a first shared secret key K_AMFDerived, NAS Key (say K ') contained in the NAS context identified by the non-3GPP NAS Security identity'_NASintAnd/or K'_NASenc) Based on a second shared secret key K'_AMFDerived, second shared secret key K'_AMFBased on a first shared secret key K_AMFAnd deducing to obtain. The 3GPP NAS security identification and the non-3GPP NAS security identification have different values.

Optionally, the NAS key (such as K) in the NAS security context identified by the 3GPP NAS security identity_NASintAnd/or K_NASenc) And NAS Key (say K ') contained in NAS Security context identified by non-3GPP NAS Security identity'_NASintAnd/or K'_NASenc) May be based on the same shared secret key K_AMFAnd deducing to obtain that the 3GPP NAS security identification and the non-3GPP NAS security identification have the same value.

S402: and the network function entity sends the NAS security identification to the terminal.

Optionally, the network function entity sends a NAS message to the terminal, where the NAS message carries the NAS security identifier ngKSI_NAS。

Optionally, before S401, the method further includes: and the network function entity distributes a security identifier ngKSI for the terminal and sends the security identifier ngKSI to the terminal. Wherein the security identity ngKSI can be used for identifying a shared secret key K between the UE and the AMF_AMF。

Optionally, the network function entity may send the security identifier ngKSI to the terminal through the authentication request message.

When the UE initially accesses the 5G core network, the NAS security identity ngKSI may be performed according to the flow shown in fig. 4 described above_NASAllocation and transmission.

After the UE initially accesses the 5G core network, if network handover is performed, the NAS security identity ngKSI may also be implemented through the flow shown in fig. 4_NASAnd informing the UE of it. Specifically, the target AMF to which the UE is switched allocates the NAS security identifier ngKSI for the UE_NASAnd sending a switching request message to a target base station of the UE, wherein the switching request message carries the currently allocated NAS security identifier ngKSI_NASThe NAS security identity ngKSI is identified by the target base station_NASAnd sending the information to the UE.

In the above-mentioned flow shown in fig. 4, the network function entity may be a network element of a core network of a 5G system, for example, may be an AMF. If the UE is connected to the same 5G core network through the 3GPP access and the non-3GPP access at the same time, when the selected N3IWF and the 3GPP access are located in the same PLMN, the UE is served by one AMF, so that NAS keys corresponding to different NAS connections can be distributed to the terminal through the AMF.

Based on the flow shown in fig. 4, in a possible implementation manner, in S402, after performing identity authentication on a 3GPP access initiated by a terminal, a network function entity sends a first NAS security mode command to the terminal, where the first NAS security mode command carries a 3GPP NAS security identifier; and the network functional entity sends a second NAS security mode command to the terminal after the terminal initiates the non-3GPP access, wherein the second NAS security mode command carries the non-3GPP NAS security identification.

The method can be applied to a scene that 3GPP access is executed first and then non-3GPP access is executed under the condition that the UE adopts an Authentication mode of 5G Authentication and Key Agreement (AKA).

AKA uses the challenge response mechanism to complete the identity authentication between the user and the network, and simultaneously negotiates the communication encryption key based on the identity authentication. The attack behavior is better prevented through the authentication and encryption means, and the security of the mobile communication network resources is protected.

As shown in fig. 5, the process may include:

step 1: the SEAF sends an Authentication Data Request (Authentication Data Request) message to the AUSF. The SEAF and AMF may be combined.

Step 2: the AUSF sends an authentication information request (Auth-infoReq) message to the UDM/ARPF.

Wherein UDM/ARPF means that UDM and ARPF are combined in one device.

And step 3: and the UDM/ARPF sends an authentication information feedback (Auth-info Resp) message to the AUSF, wherein the AuSF message carries the authentication vector of the UE.

And 4, step 4: the AUSF sends a 5G authentication initiation Answer (5G authentication Answer) message to the SEAF.

And 5: the SEAF sends a User authentication request (User authentication request) message to the UE, wherein the message carries a random number RAND, an authentication parameter AUTN and a security context identifier ngKSI, and the security context identified by the ngKSI can contain a shared secret key K_AMF。

Wherein the security identity ngKSI may be assigned by the SEAF. The security identifier ngKSI may also be allocated by the AUSF, in which case the 5G authentication initiation reply message sent by the AUSF in step 4 carries the security identifier ngKSI. The security identity ngKSI may also be assigned by the AMF, which may be carried in a message sent by the AMF to the SEAF after obtaining the authenticated shared key.

Step 6: and the UE sends a User authentication feedback message (User authentication response) to the SEAF, wherein the User authentication feedback message carries a verification parameter RES.

And 7: and the SEAF compares the verification parameter RES received by the SEAF with the verification parameter XRES generated by the SEAF, and performs identity authentication according to the comparison result.

And 8: the SEAF sends a 5G AC message to the AUSF and informs the AUSF of the identity authentication result.

And step 9: the AMF sends a 5G NAS Security Mode Command (5G NAS Security Mode Command) to the UE, wherein the Command carries NAS Security identification KSI corresponding to NAS connection established based on 3GPP access_NAS。KSI_NASFor identifying NAS security context corresponding to NAS connection established based on 3GPP access, the NAS security context can contain NAS secret key K for integrity protection_NASintAnd/or NAS key K for encryption algorithms_NASenc。

Therein, NAS security identity KSI_NASMay be assigned by the AMF.

Step 10: the UE sends a 5G NAS Security Mode Complete message (5G NAS Security Mode Complete) to the AMF. Optionally, the message may carry the above mentioned NAS security identity KSI_NAS。

Step 11: the UE performs network access based on a non-3GPP access network, and performs identity Authentication (Authentication) between the SEAF and the AUSF. The process is similar to the above step 1 to step 8. In the process, AUSF allocates NAS security identification KSI 'to the terminal'_NAS。KSI’_NASFor identifying NAS security context corresponding to NAS connection established based on non-3GPP access, wherein the NAS security context can contain NAS secret key K 'for integrity protection'_NASintAnd/or NAS key K 'for encryption algorithm'_NASenc。

Step 12: the AMF sends a 5G NAS Security Mode Command (5G NAS Security Mode Command) to the UE, wherein the Command carries NAS Security identification KSI 'corresponding to NAS connection established based on non-3GPP access'_NAS。

Wherein the NAS safety sign KSI'_NASMay be assigned by the AMF.

Step 13: the UE sends a 5G NAS Security Mode complete message (5G NAS Security Mode Command) to the AMF. Optionally, the message may carry the NAS security identity KSI'_NAS。

It should be noted that, in step 11, the identity authentication process when the UE performs network access based on the non-3GPP access network may be omitted.

The method can be suitable for the scene that the 3GPP access is executed firstly and then the non-3GPP access is executed under the condition that the UE adopts the EAP-AKA' authentication mode.

Extensible Authentication Protocol (EAP) Protocol is a set of a series of verification methods, and the design concept is to meet the requirement of identity Authentication of any link layer and support multiple link layer Authentication methods.

As shown in fig. 6, the process may include:

step 1: the SEAF sends an Authentication data request (Authentication data request) message to the AUSF.

The SEAF and AMF may be combined.

Wherein UDM/ARPF means that UDM and ARPF are combined in one device.

And 4, step 4: the AUSF sends a 5G identity Authentication Initiation Answer (5G Authentication Initiation Answer) message to the SEAF, wherein the message carries an EAP-Req-AKA'/challenge request message and a root security identification ngKSI, and the ngKSI is used for identifying a shared secret key K_AMF。

Wherein the security identity ngKSI may be assigned by the SEAF. The security identifier ngKSI may also be allocated by the AUSF, in which case the 5G authentication initiation reply message sent by the AUSF in step 4 carries the security identifier ngKSI. The security identifier ngKSI may also be assigned by the AMF, and may be carried in a message sent to the SEAF after the AMF obtains the authenticated shared key.

And 5: the SEAF sends a User authentication request (User authentication request) message to the UE, wherein the User authentication request message carries the EAP-Req-AKA'/challenge request message and the root security identifier ngKSI. The security context identified by ngKSI may contain a shared secret key K_AMF。

Step 6: and the UE sends a User authentication feedback (User authentication response) message to the SEAF, wherein the message carries the verification parameter RES.

And 8: the SEAF sends a 5G AC message to the AUSF and informs the AMF of the identity authentication result.

Therein, NAS security identity KSI_NASMay be assigned by the AMF.

Step 12: AMF sends 5G NAS Security mode Command (5G NAS Secur) to UEity Mode Command) carrying a NAS security identity KSI 'corresponding to a NAS connection established based on non-3GPP access'_NAS。

Wherein the NAS safety sign KSI'_NASMay be assigned by the AMF.

Based on the flow shown in fig. 4, in a possible implementation manner, in S402, after performing identity authentication on a 3GPP access initiated by a terminal, a network function entity sends a first NAS security mode command to the terminal, where the first NAS security mode command carries a non-3GPP NAS security identifier; and the network functional entity sends a second NAS security mode command to the terminal after the terminal initiates the 3GPP access, wherein the second NAS security mode command carries the 3GPP NAS security identification.

As shown in fig. 7, the process may include:

step 1a to step 1 b: the UE connects to an untrusted non-3GPP access network, selects the N3IWF, and obtains the IP address.

Step 2 to step 8 a: and the UE and the network side perform an identity authentication process.

And step 8 b: AUSF sends AAA (Authentication, Authorization, Accounting) message to AMF, AMF sends message to N31WF, which carries security identification ngKSI. The security context identified by the security identifier ngKSI may contain a shared secret key K_AMF。

Wherein the security identity ngKSI may be assigned by the AMF.

And step 8 c: the AMF sends an N2 message to N31WF, which carries an authentication request message (auth. request), an EAP-Req-AKA'/challenge message, and a security identity ngKSI.

And step 8 d: n31WF sends identity authentication response (IKE _ AUTH Res) message to UE, wherein EAP-Req message, 5G-NAS message, NAS-PDU message, Auth request message, EAP/AKA-Challenge message and security identification ngKSI are carried.

Step 8e to step 9 b: the UE initiates an authentication request procedure.

In step 9a, AMF sends N2 message to N31WF, where the N3IWF key, SMC request message, EAP-Success message, and security identity ngKSI are carried. In step 9b, N31WF sends IKE _ AUTH Res message to UE, wherein the message carries EAP-Req message, 5G-NAS message, NAS-PDU message, SMC request message, EAP-Success message and security identification ngKSI.

Step 10a to step 11: and the UE interacts with the N3IWF to complete identity authentication.

Step 12: AMF sends 5G NAS Security Mode Command (5G NAS Security Mode Command) to UE, wherein NAS Security identification KSI 'is carried'_NAS。KSI’_NASFor identifying NAS security context corresponding to NAS connection established based on non-3GPP access, wherein the NAS security context can contain NAS secret key K 'for integrity protection'_NASintAnd/or NAS key K 'for encryption algorithm'_NASenc。

Wherein the NAS safety sign KSI'_NASMay be assigned by the AMF.

Step 14: UE carries out network access based on 3GPP access network, AMF distributes NAS safety identification KSI for the terminal_NAS。KSI_NASFor identifying NAS security context corresponding to NAS connection established based on 3GPP access, the NAS security context can contain NAS secret key K for integrity protection_NASintAnd/or NAS key K for encryption algorithms_NASenc。

Step 15: the AMF sends a 5G NAS Security Mode Command (5G NAS Security Mode Command) to the UE, wherein the Command carries NAS Security identification KSI corresponding to NAS connection established based on 3GPP access_NAS。

Therein, NAS security identity KSI_NASMay be assigned by the AMF.

Step 16: the UE sends a 5G NAS Security Mode Complete message (5G NAS Security Mode Complete) to the AMF. Optionally, the message may carry the above mentioned NAS security identity KSI_NAS。

Optionally, in this embodiment of the present application, the security identifier ngKSI may include:

-an identity value information field for carrying a value of the security identity;

-a security context type information field for carrying indication information of a security context type. The indication information may identify a key mapped from the 4G network or identify a key generated based on a 5G network master authentication mode.

For example, the format of the root security identity ngKSI may be as shown in fig. 8. The length of the ngKSI is one byte, wherein bits 1 to 3 are identification value information fields, and the value is the value of the ngKSI; bit 4 is the security context type information field; bits 5 to 8 are used to carry the relevant information of the information unit.

Optionally, in this embodiment of the present application, the NAS security identifier ngKSI_NASCan include the following steps:

-an identity value information field for carrying a value of the NAS security identity;

For example, the NAS key identifies ngKSI_NASMay be as shown in fig. 9. ngKSI_NASThe length is one byte, wherein, bits 1 to 3 are identification value information fields, and the value is ngKSI_NASTaking the value of (A); bit 4 is the security context type information field; bits 5 to 8 are used to carry the relevant information of the information unit.

Fig. 10 to fig. 15 are combined to describe a security identifier management flow diagram according to another embodiment of the present application.

As shown in fig. 10, a schematic view of a security identifier management process provided in the embodiment of the present application, where the process may include:

s1001: and the network function entity distributes the security identifier ngKSI to the terminal.

Wherein the security identity ngKSI is a key identity used in the 5G system. The ngKSI is used for identifying a key shared between the terminal and the network side and an NAS security context obtained based on key deduction. ngKSI is associated with the shared key.

The network function entity for allocating the security identifier ngKSI to the terminal may be AUSF, AMF or N3 IWF.

The format of the security identifier ngKSI may be as shown in fig. 8.

S1002: and the network function entity sends the security identifier ngKSI to the terminal.

Based on the flow shown in fig. 10, the method is applicable to a scenario in which the UE performs 3GPP access when the UE adopts a 5G AKA' authentication method.

In a possible implementation manner, the network function entity that allocates the ngKSI is an AUSF, and the NAS security context identified by the ngKSI is an NAS security context corresponding to an NAS connection established based on a 3GPP access. As shown in fig. 11, the process may include:

step 1-2: the AUSF sends an authentication information request (Auth-info Req) message to the UDM/ARPF, and the UDM/ARPF returns an authentication information response (Auth-info Resp) message to the AUSF, wherein the Auth-info Resp message carries the authentication vector of the UE.

Wherein UDM/ARPF means that UDM and ARPF are combined in one device.

And step 3: the AUSF sends an Authentication Initiation Answer (5G-AIA) message to the SEAF, wherein the message carries the security identifier ngKSI.

Wherein the security identifier ngKSI is generated by AUSF.

And 4, step 4: the SEAF sends an authentication request (Auth-Req) message to the UE, wherein the authentication request (Auth-Req) message carries a security identifier ngKSI.

Step 5-6: the UE sends an authentication response (Auth-Resp) message to the SEAF, and the SEAF returns a response message to the AUSF. This process is optional.

If the network entity belongs to different PLMNs, the UE needs to store two ngKSIs and security contexts, one is used for identifying a key shared by non-3GPP access and a non-access stratum (NAS) security context obtained based on key deduction; a key for identifying non-3GPP access sharing and a non-access stratum NAS security context derived based on the key derivation.

Based on the above-mentioned flow shown in fig. 10, in a possible implementation manner, the method is applicable to a scenario where the UE performs 3GPP access under the condition of adopting an EAP-AKA' authentication manner.

In a possible implementation manner, the network function entity that allocates the ngKSI is an AUSF, and the NAS security context identified by the ngKSI is an NAS security context corresponding to an NAS connection established based on a 3GPP access. As shown in fig. 12, the process may include:

Wherein UDM/ARPF means that UDM and ARPF are combined in one device.

And step 3: the AUSF sends an N12 message (5G-AIA) to the SEAF, which carries EAP-Pequest message/AKA' -Chanllenge parameters.

Wherein the security identifier ngKSI is generated by AUSF.

And 4, step 4: the SEAF sends an authentication request (Auth-Req) message to the UE, wherein the message is an N1 message, the message carries a security identifier ngKSI and can also carry EAP-Pequest message/AKA' -Chanllenge parameters.

Step 5-6: the UE sends an authentication Response (Auth-Resp) message to the SEAF, wherein the message is an N1 message, the EAP-Response message/AKA' -Chanllenge parameters are carried in the message, and the SEAF returns a Response message to the AUSF. This process is optional.

And 7: and carrying out conditional exchange notification message transmission between the UE and the AUSF.

And 8: the AUSF sends an N12 message to the SEAF, which may carry EAP-success parameters or anchor key parameters.

And step 9: the SEAF sends an N1 message to the UE, which may carry EAP-success parameters.

In a possible implementation manner, a new attribute may be defined by modifying the EAP-AKA 'protocol, the format of AT _ ngKSI is shown in fig. 13, AT _ ngKSI may be set to a specified value according to the parameter attribute of EAP-AKA', the length is the length value of the attribute, the specific value of ngKSI is set to 1 byte, the valid bit is 4-5 bits, and other purposes are reserved. This attribute will be sent to the UE via a bearer in an EAP-Request/AKA' -Challenge message.

Based on the flow shown in fig. 10, in a possible implementation manner, the network function entity that allocates the security identifier ngKSI is an AUSF, and the NAS security context identified by the security identifier ngKSI is an NAS security context corresponding to an NAS connection established based on a non-3GPP access. The above method is suitable for a scenario where the UE performs non-3GPP access in the case of using a 5G AKA' authentication method, and a signaling interaction procedure thereof may be as shown in fig. 14.

As shown in fig. 14, the UE establishes an IPsec tunnel with the N3IWF, and if the security identity ngKSI is sent to the UE through the NAS message and the N2 message, the message is sent to the UE through 8b (ngKSI is generated by AUSF), 8c (ngKSI is generated by AMF), and further N31WF through 8d (ngKSI is carried by Auth-Req message). The process may include:

And step 8 b: and the AUSF generates a security identifier ngKSI and sends the AAA message to the SEAF/AMF, wherein the security identifier ngKSI carries an Authentication Vector (AV).

Wherein, the SEAF/AMF means that the SEAF and the AMF are combined in one device.

And step 8 c: the SEAF/AMF sends an N2 message to N31WF, wherein the message carries an authentication request message (Auth-Req) and a security identity ngKSI.

And step 8 d: n31WF sends IKE _ AUTH request message to UE, which carries EAP request message, 5G-NAS message, NAS-PDU message, authentication request message (Auth-Req) and security identification ngKSI.

Step 8e to step 8 f: the UE initiates an authentication request procedure.

Based on the flow shown in fig. 10, in a possible implementation manner, the network functional entity that allocates the security identifier ngKSI is an AMF, and the NAS security context identified by the security identifier ngKSI is an NAS security context corresponding to an NAS connection that is established based on a non-3GPP access. The method is suitable for a scenario where the UE performs non-3GPP access in case of using an EAP-AKA' authentication method, and a signaling interaction procedure thereof may be as shown in fig. 15.

As shown in fig. 15, in one possible implementation, the security identity ngKSI may be generated by AUSF and AMF, respectively, and if the security identity ngKSI is generated by AMF, it may be sent to the UE through an EAP-Req-AKA'/challenge message. The attributes of the added AT _ ngKSI are in the format of fig. 14. The process may include:

8 b: the AUSF sends an AAA message to the AMF, which carries an EAP-Req-AKA'/Challenge message.

8 c: the AMF sends an N2 message to the N3IWF, wherein an authentication Request (Auth-Request) message is carried, and an EAP-Req AKA'/Challenge message is carried.

8 d: the N3IWF sends IKE _ AUTH Request information to the UE, wherein the IKE _ AUTH Request information carries EAP Request information, 5G-NAS information, NAS-PDU information, authentication Request information (Auth-Request) and EAP-ReqAKA'/Challenge information.

8 e: the UE sends an IKE _ AUTH Response message to the N3IWF, wherein the IKE _ AUTH Response message carries an EAP Response message, a 5G-NAS message, an NAS-PDU message, an authentication Response message (Auth-Response) and an EAP-RepeaKA'/Challenge message.

8 f: the N3IWF sends an N2 message to the AMF, wherein the message carries an authentication Response (Auth-Response) message and an EAP-Rep AKA'/Challenge message.

Step 8g to step 9 b: the UE initiates an authentication request procedure.

Step 12: the UE transmits the consecutive NAS messages to the AMF through the IPsec SA.

In a possible implementation manner, the network functional entity that allocates the ngKSI is AMF, and the NAS security context identified by the ngKSI is an NAS security context corresponding to an NAS connection established based on a 3GPP access. In this implementation, the SEAF sends a K to the AMF_AMFAMF receives K_AMFAnd then generating a security identifier ngKSI, and sending an attach request response, an attach request response or a registration response, or a periodic update message response, or a NAS security mode command message to the UE.

In a possible implementation manner, the network functional entity that allocates the security identifier ngKSI is an N3IWF, and the NAS security context identified by the security identifier ngKSI is NAS security corresponding to the NAS connection established based on the non-3GPP accessContext. In this implementation, AUSF sends K to N3IWF_N3IWFN3IWF receives K_N3IWFAnd then generating a security identifier ngKSI, and sending the security identifier passing the authentication success message to the UE.

It should be noted that, if the SEAF and the AMF do not adopt the combined phase, the security identifier ngKSI may be sent to the UE through another newly defined NAS message.

In the inter-system Handover scenario, the AMF is responsible for mobility management, and needs to calculate a derived key by the target AMF, and send the assigned ngKSI to the target base station through a Handover Request (Handover Request) message. The ngKSI of the UE side is allocated by the UE.

Based on the same technical concept, the embodiment of the present application further provides a network function entity, which can implement the security identifier management method provided in the above embodiments.

Referring to fig. 16, which is a schematic structural diagram of the network functional entity, the network functional entity may include: an assigning module 1601, and a sending module 1602.

An allocating module 1601, configured to allocate a non-access stratum NAS security identifier for a terminal, where the NAS security identifier is used to identify an NAS security context, and the NAS security context is used to protect security of an established NAS connection.

A sending module 1602, configured to send the NAS security identifier to the terminal.

Optionally, the NAS security context identified by the 3GPP NAS security identifier includes an NAS key derived based on shared key derivation, an NAS counter value, and an NAS connection identifier; the NAS security context identified by the non-3GPP NAS security identity comprises an NAS key obtained based on shared key deduction, an NAS counter value and an NAS connection identity.

Optionally, the NAS security identity includes: the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; and a non-3GPP NAS security identifier, which is used for identifying the NAS security context corresponding to the NAS connection established by the terminal based on the non-3GPP access.

Optionally, the NAS key included in the NAS security context identified by the 3GPP NAS security identity is derived based on a first shared key, the NAS key included in the NAS security context identified by the non-3GPP NAS security identity is derived based on a second shared key, and the second shared key is derived based on the first shared key; the 3GPP NAS security identification and the non-3GPP NAS security identification have different values.

Optionally, the NAS key included in the NAS security context identified by the 3GPP NAS security identifier is derived based on a first shared key, the NAS key included in the NAS security context identified by the non-3GPP NAS security identifier is derived based on the first shared key, and the 3GPP NAS security identifier and the non-3GPP NAS security identifier have the same value.

Optionally, the sending, by the network function entity, the NAS security identifier to the terminal includes: and the network function entity sends NAS information to a terminal, wherein the NAS information carries the NAS safety identification.

Optionally, the NAS security identity includes: the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; and the non-3GPP NAS security identifier is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access.

Optionally, the sending, by the network function entity, an NAS message to a terminal, where the NAS message carries the NAS security identifier includes: after the network functional entity performs identity authentication on the 3GPP access initiated by the terminal, a first NAS security mode command is sent to the terminal, and the first NAS security mode command carries the 3GPP NAS security identification; and the network function entity sends a second NAS security mode command to the terminal after the terminal initiates the non-3GPP access, wherein the second NAS security mode command carries the non-3GPP NAS security identification.

Optionally, the sending, by the network function entity, an NAS message to a terminal, where the NAS message carries the NAS security identifier includes: and after performing identity authentication on the non-3GPP access initiated by the terminal, the network function entity sends a first NAS security mode command to the terminal, wherein the first NAS security mode command carries the non-3GPP NAS security identification.

Optionally, the network function entity sends a second NAS security mode command to the terminal after the terminal initiates the 3GPP access, where the second NAS security mode command carries the 3GPP NAS security identifier.

Optionally, the sending the root key identifier to the terminal includes: and the network functional entity sends an authentication request message to the terminal, wherein the authentication request message carries the root key identifier.

Optionally, the NAS security identity includes:

Optionally, the network function entity is an AMF.

Referring to fig. 17, which is a schematic structural diagram of the network functional entity, the network functional entity may include: an assignment module 1701, and a transmission module 1702.

An allocating module 1601, configured to allocate a security identifier for a terminal, where the security identifier is used to identify a key shared between the terminal and a network side and a non-access stratum NAS security context derived based on the key.

A sending module 1602, configured to send the security identifier to the terminal.

Optionally, the security identifier is a key identifier used in a 5G system.

Optionally, the network function entity is an AUSF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a 3GPP access.

Optionally, the allocating, by the network function entity, a security identifier for the terminal includes: and the AUSF acquires an authentication vector of the terminal and generates the safety identification for the terminal.

Optionally, the sending, by the network function entity, the security identifier to the terminal includes: and the AUSF sends an identity authentication start response message to the SEAF, the identity authentication start response message carries the safety identification, the identity authentication start response message is used for triggering the SEAF to send an authentication request message to the terminal, and the authentication request message carries the safety identification.

Optionally, the network functional entity is an AMF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a 3GPP access.

Optionally, the allocating, by the network function entity, a security identifier for the terminal includes: and the AMF receives a shared secret key sent by the SEAF and generates a security identifier for the shared secret key, wherein the shared secret key is a shared secret key between the terminal and the AMF.

Optionally, the sending, by the network function entity, the security identifier to the terminal includes: the AMF sends a security identification to the UE through a non-access stratum message, wherein the type of the non-access stratum message is an attachment request response or a registration response, or a periodic update message response, or a NAS security mode command message.

Optionally, the network function entity is an AUSF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a non-3GPP access.

Optionally, the sending, by the network function entity, the security identifier to the terminal includes: and the AUSF sends an AAA message to the SEAF, the AAA message carries the security identifier, the AAA message is used for triggering the SEAF to send an authentication request message to the terminal through the N3IWF, and the authentication request message carries the security identifier.

Optionally, the network functional entity is an AMF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a non-3GPP access.

Optionally, the sending, by the network function entity, the security identifier to the terminal includes: the AMF receives a shared secret key sent by the SEAF, generates a security identifier for the terminal, and sends the security identifier to the N3IWF to trigger the N3IWF to send an authentication success message to the terminal, wherein the authentication request message carries the security identifier.

Optionally, the network function entity is an N3IWF, and the NAS security context identified by the security identifier is an NAS security context corresponding to an NAS connection established based on a non-3GPP access.

Optionally, the sending, by the network function entity, the security identifier to the terminal includes: and the N3IWF receives the shared key sent by the AUSF, generates a security identifier for the terminal, and sends a message that the security identifier passes the authentication success to the UE.

Optionally, the method further comprises: and the AMF allocates a safety identification for the terminal and sends a switching request message to a target base station of the terminal, wherein the switching request message carries the currently allocated safety identification.

Optionally, the security identifier includes:

Referring to fig. 18, a schematic structural diagram of a network functional entity provided in the embodiment of the present application is shown in fig. 18, where the base station may include: a processor 1801, a memory 1802, a transceiver 1803, and a bus interface.

The processor 1801 is responsible for managing the bus architecture and general processing, and the memory 1802 may store data used by the processor 1801 in performing operations. The transceiver 1803 is used to receive and transmit data under the control of the processor 1801.

The bus architecture may include any number of interconnected buses and bridges, with one or more processors represented by processor 1801 and various circuits of memory represented by memory 1802 being linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, power management circuits, and the like, which are well known in the art, and therefore, will not be described any further herein. The bus interface provides an interface. The processor 1801 is responsible for managing the bus architecture and general processing, and the memory 1802 may store data used by the processor 1801 in performing operations.

The process disclosed in the embodiment of the present invention may be applied to the processor 1801, or implemented by the processor 1801. In implementation, the steps of the signal processing flow may be implemented by integrated logic circuits of hardware or instructions in the form of software in the processor 1801. The processor 1801 may be a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or the like that may implement or perform the methods, steps, and logic blocks disclosed in embodiments of the present invention. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of a method disclosed in connection with the embodiments of the present invention may be directly implemented by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor. The software module may be located in ram, flash memory, rom, prom, or eprom, registers, etc. storage media as is well known in the art. The storage medium is located in the memory 1802, and the processor 1801 reads the information in the memory 1802 and completes the steps of the signal processing flow in conjunction with the hardware thereof.

Specifically, the processor 1801 is configured to read a program in the memory 1802 and execute the uplink reference signal transmission procedure or the downlink reference signal transmission procedure implemented by the foregoing base station side, or may execute the uplink reference signal transmission procedure and the downlink reference signal transmission procedure.

Referring to fig. 19, which is a schematic structural diagram of a network functional entity provided in the embodiment of the present application, as shown in fig. 19, the terminal may include: a processor 1901, a memory 902, a transceiver 1903, and a bus interface.

The processor 1901 is responsible for managing the bus architecture and general processing, and the memory 1902 may store data used by the processor 1901 in performing operations. The transceiver 1903 is used for receiving and transmitting data under the control of the processor 1901.

The bus architecture may include any number of interconnected buses and bridges, with one or more processors represented by processor 1901 and various circuits of memory represented by memory 1902 being linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, power management circuits, and the like, which are well known in the art, and therefore, will not be described any further herein. The bus interface provides an interface. The processor 1901 is responsible for managing the bus architecture and general processing, and the memory 1902 may store data used by the processor 1901 in performing operations.

The process disclosed in the embodiment of the present invention can be applied to the processor 1901, or implemented by the processor 1901. In implementation, the steps of the signal processing flow may be performed by integrated logic circuits of hardware or instructions in the form of software in the processor 1901. The processor 1901 may be a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or the like that implement or perform the methods, steps, and logic blocks disclosed in embodiments of the present invention. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of a method disclosed in connection with the embodiments of the present invention may be directly implemented by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor. The software module may be located in ram, flash memory, rom, prom, or eprom, registers, etc. storage media as is well known in the art. The storage medium is located in the memory 1902, and the processor 1901 reads the information in the memory 1902 and completes the steps of the signal processing flow in conjunction with the hardware thereof.

Specifically, the processor 1901 is configured to read a program in the memory 1902 and execute the uplink reference signal transmission procedure or the downlink reference signal transmission procedure implemented on the terminal side, or execute the uplink reference signal transmission procedure and the downlink reference signal transmission procedure.

Claims

1. A method for secure identity management, the method comprising:

a network function entity allocates a non-access stratum (NAS) security identifier for a terminal, wherein the NAS security identifier is used for identifying an NAS security context, and the NAS security context is used for protecting the security of the established NAS connection; the NAS security identifier comprises a 3GPP NAS security identifier and a non-3GPP NAS security identifier, the 3GPP NAS security identifier is used for identifying NAS security context corresponding to NAS connection established by the terminal based on a 3GPP access, and the non-3GPP NAS security identifier is used for identifying NAS security context corresponding to NAS connection established by the terminal based on a non-3GPP access; the NAS security context identified by the non-3GPP NAS security identity comprises an NAS key obtained by deduction based on a shared key, an NAS counter value and an NAS connection identity;

the network function entity sends the NAS security identification to the terminal; wherein, the network function entity sends the NAS security identifier to the terminal, including:

when the terminal carries out network switching, the network functional entity sends a switching request message to a target base station switched by the terminal, wherein the switching request message carries the NAS security identification; and the target base station sends the NAS security identification to the terminal.

2. The method of claim 1, wherein NAS keys included in the NAS security context identified by the 3GPP NAS security identity are derived based on a first shared key, wherein NAS keys included in the NAS security context identified by the non-3GPP NAS security identity are derived based on a second shared key, and wherein the second shared key is derived based on the first shared key;

3. The method of claim 1, wherein the NAS key included in the NAS security context identified by the 3GPP NAS security identity is derived based on a first shared key, and wherein the NAS key included in the NAS security context identified by the non-3GPP NAS security identity is derived based on the first shared key;

4. The method of claim 1, wherein the network function entity sending the NAS security identity to the terminal comprises:

5. The method of claim 4, wherein the NAS security identity comprises: the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; the non-3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access;

6. The method of claim 4, wherein the NAS security identity comprises: the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; the non-3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access;

7. The method of claim 1, wherein the network function entity sending the NAS security identity to the terminal comprises:

8. The method of claim 1, wherein the NAS security identity comprises:

9. The method of claim 1, wherein the network function entity is an AMF.

10. A network function entity, comprising:

the terminal comprises an allocation module, a non-access stratum (NAS) security identifier, a Network Access Stratum (NAS) security context and a Network Access Server (NAS) security context, wherein the allocation module is used for allocating the NAS security identifier for the terminal, the NAS security identifier is used for identifying the NAS security context, and the NAS security context is used for protecting the security of the established NAS connection; the NAS security identifier comprises a 3GPP NAS security identifier and a non-3GPP NAS security identifier, the 3GPP NAS security identifier is used for identifying NAS security context corresponding to NAS connection established by the terminal based on a 3GPP access, and the non-3GPP NAS security identifier is used for identifying NAS security context corresponding to NAS connection established by the terminal based on a non-3GPP access; the NAS security context identified by the non-3GPP NAS security identity comprises an NAS key obtained by deduction based on a shared key, an NAS counter value and an NAS connection identity;

a sending module, configured to send the NAS security identifier to the terminal; wherein, the network function entity sends the NAS security identifier to the terminal, including:

11. A network function entity, comprising: the system comprises a processor, a memory and a transceiver, wherein the processor, the memory and the transceiver are connected through a bus; the processor is used for reading the program in the memory and executing:

allocating a non-access stratum (NAS) security identifier for a terminal, wherein the NAS security identifier is used for identifying an NAS security context, and the NAS security context is used for protecting the security of the established NAS connection; the NAS security identifier comprises a 3GPP NAS security identifier and a non-3GPP NAS security identifier, the 3GPP NAS security identifier is used for identifying NAS security context corresponding to NAS connection established by the terminal based on a 3GPP access, and the non-3GPP NAS security identifier is used for identifying NAS security context corresponding to NAS connection established by the terminal based on a non-3GPP access; the NAS security context identified by the non-3GPP NAS security identity comprises an NAS key obtained by deduction based on a shared key, an NAS counter value and an NAS connection identity;

sending the NAS security identification to the terminal through the transceiver; wherein, the network function entity sends the NAS security identifier to the terminal, including:

12. The network functional entity of claim 11, wherein NAS keys included in the NAS security context identified by the 3GPP NAS security identity are derived based on a first shared key, wherein NAS keys included in the NAS security context identified by the non-3GPP NAS security identity are derived based on a second shared key, and wherein the second shared key is derived based on the first shared key;

13. The network functional entity of claim 11, wherein the NAS key included in the NAS security context identified by the 3GPP NAS security identity is derived based on a first shared key, and wherein the NAS key included in the NAS security context identified by the non-3GPP NAS security identity is derived based on the first shared key;

14. The network functional entity of claim 11, wherein the processor is specifically configured to:

15. The network functional entity of claim 14, wherein the NAS security identity comprises: the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; the non-3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access;

the processor is specifically configured to:

16. The network functional entity of claim 14, wherein the NAS security identity comprises: the 3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on 3GPP access; the non-3GPP NAS security identification is used for identifying NAS security context corresponding to NAS connection established by the terminal based on non-3GPP access;

the processor is specifically configured to:

17. The network functional entity of claim 11, wherein the processor is specifically configured to:

18. The network functional entity of claim 11, wherein the NAS security identity comprises:

19. The network function entity of claim 11, wherein the network function entity is an AMF.

20. A computer-readable storage medium having stored thereon computer-executable instructions for causing a computer to perform the method of any one of claims 1 to 9.